Extracted

• • Target
    RV NRO. 15001505100320196799680 DESARCHIVO DESPACHO JUDICIAL JUZGADO ADMINISTRATIVO 12 -.msg
  • Size 7.5MB
  • SHA256 d45fdd82b77069225a3b02a8ae0975eb4e8f18c2943614bae304f608075e6ce7
  • MD5 47ef81a5c589bd556fca903224003418
  • SHA1 984329e77433a609f0fc5937e65b7706d06aa438
  • SHA512 64a2629a6523ce5ea2a2147fbe928b2b791160f5c25980a2d6062d59cdcfe2be14b7182a2d1392e60d26deb24aa7f8e899d9140dd8275f1928fbd21291befac9
  • SSDEEP 24576:kJrm1LWdVHNjC7nvSUVsTe8XprmzsO4cOwuB+nZZGpt0eAXVBhO5GeUTRWwDFpIc:ige9M7K7G
  • TLSH
    T1AC86BEBCBA582D59AA3E877ECE93ACD807D72D12599B94C8C0697BC30033775ED43816
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  adwarediscoveryspyware
  behavioral1behavioral2
• • Target
    Re comprobante.duplicado.Tutela-Cierre-Decomiso.xhtml
  • Size 7.4MB
  • SHA256 89b2c94620b27a6eddc84312da16a94fbe4871c6e20b2fbfb12a3899f8ea9337
  • MD5 280795a5a6b56c8a3a6c7753ff008e38
  • SHA1 2bbc4835baf6537777525914c74b92dfda0dfa30
  • SHA512 b9d897049d0ab81aa2e75246d8029bd22c5ed20fe549db81a010150321dbd0ec7aa08af90e1be63c40def943cde31f05d469189d11c6a1193aa9926cdfa2ef69
  • SSDEEP 24576:km1LWdVHNjC7nvSUVsTe8XprmzsO4cOwuB+nZZGpt0eAXVBhO5GeUTRWwDFpIQc4:de9M7K7Gh
  • TLSH
    T11476BEBDAA6C2D592A3E876FCE53ACD807D72D12599B94C8C0697BC30023779FD43816
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionevolutionratpersistenceprivilege_escalationrat

  • Family: EvolutionRAT

    EvolutionRAT is a Windows RAT written in C.

    ratevolutionrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Deletes itself

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral3behavioral4
• • Target
    image001.png
  • Size 6KB
  • SHA256 9803c1a07a66da0cb84e486b2ba4020d046f919101762a3e30be90b34a097e2a
  • MD5 9aca27524ac094b7022f44d18cdd8b55
  • SHA1 d5d7f9ddab97fbf071c3926da9ecac2d7c8756c5
  • SHA512 27f3fc51de57a5ab40a6cddf68fe24007d79bc71117b651d00263a05b23fb487128aae3395da9806ca3154e00f3dd0a45ee3f52b425a2acbc9b62f450d9878e0
  • SSDEEP 192:j2Xu9D4/UcEXT0oULdDaEFzGMGcroilklT5GT:j7Dd0ocDaKzdhoiOlT50
  • TLSH
    T155D19D912422D02E973DC527A056B38AB1370F941AB97B08F51EEF1824C59C70FDB8DB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5behavioral6